amber

package

v0.0.0-...-f6eb2dc Latest Latest Go to latest Published: Feb 22, 2024 License: MIT Imports: 6 Imported by: 1

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/EgeBalci/amber

Documentation ¶

Index ¶

Constants
Variables
type PE
- func Open(fileName string) (bp *PE, err error)

Constants ¶

View Source

const (
	PE_DOS_STUB = "This program cannot be run in DOS mode"
)

Variables ¶

View Source

var (
	ErrUnsupportedArch  = errors.New("unsupported PE file architecture")
	ErrInvalidPeSpecs   = errors.New("unsupported PE file specs")
	ErrInvalidPeHeaders = errors.New("invalid PE headers")
)

View Source

var CRC_API_32 = []byte{}/* 129 elements not displayed */

View Source

var CRC_API_64 = []byte{}/* 192 elements not displayed */

View Source

var IAT_API_32 = []byte{}/* 172 elements not displayed */

View Source

var IAT_API_64 = []byte{}/* 218 elements not displayed */

View Source

var LOADER_32 = []byte{}/* 2090 elements not displayed */

View Source

var LOADER_64 = []byte{}/* 2300 elements not displayed */

View Source

var SYSCALL_LOADER_64 = []byte{}/* 2407 elements not displayed */

Functions ¶

This section is empty.

Types ¶

type PE ¶

type PE struct {
	Name            string
	FullName        string
	FileSize        int
	IAT             bool
	Resource        bool
	IgnoreIntegrity bool
	IatResolver     bool
	SyscallLoader   bool
	ScrapeHeaders   bool
	// PE specs...
	Architecture      int
	SizeOfImage       uint32
	ImageBase         uint64
	AddressOfEntry    uint32
	Subsystem         uint16
	ImportTable       uint64
	ExportTable       uint64
	RelocTable        uint64
	ImportAdressTable uint64
	HasBoundedImports bool
	HasDelayedImports bool
	HasTLSCallbacks   bool
	HasRelocData      bool
	IsCLR             bool
	IsDLL             bool
	// contains filtered or unexported fields
}

Blueprint structure contains PE specs, tool parameters and OS spesific info

func Open ¶

func Open(fileName string) (bp *PE, err error)

func (*PE) AddCallOver ¶

func (pe *PE) AddCallOver(payload []byte) ([]byte, error)

AddCallOver function adds a call instruction at the beginning of the given payload address of the payload will be pushed to the stack and execution will continue after the end of payload

func (*PE) AssembleLoader ¶

func (pe *PE) AssembleLoader() ([]byte, error)

AssemblePayload generates the binary stub bla bla...

func (*PE) ScrapePeHeaders ¶

func (pe *PE) ScrapePeHeaders() ([]byte, error)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL